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Top Stories 

• The San Onofre nuclear plant near San Diego will remain shut down while investigators try 
to discover what is causing the rapid decay of generator tubing that carries radioactive 
water. - Associated Press (See item 6) 

• The Securities and Exchange Commission sued a former United Commercial Bank vice 
president, accusing him of creating false records that contributed to the bank’s failure. The 
collapse cost the federal government $2.5 billion. - Bloomberg (See item 9) 

• A section of railroad in northeastern Indiana that carries up to 100 trains per day was shut 
for a second day while crews contended with a chemical fire caused by a train derailment. 

- Fort Wayne Journal Gazette (See item 14 ) 

• For the second time in 6 months, researchers from Kaspersky Lab led an operation to take 
down the newest iteration of the Kelihos botnet. The bot is used to send spam, carry out 
distributed denial-of-service attacks, and steal online currency. - Threatpost (See item 36) 
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Energy Sector 



Current Electricity Sector Threat Alert Levels: Physical: LOW, Cyber: LOW 

Scale: LOW, GUARDED, ELEVATED, HIGH, SEVERE [Source: ISAC for the Electricity Sector (ES-ISAC) - 
rhttp://www.esisac.coml 



1. March 28, KTBC 7 Austin - (Texas) Tanker truck crash leaves one dead. One person 
is dead and two others are in serious condition after a crash between a tanker truck and 
a car March 28 in Austin, Texas. According to a police sergeant, a BMW went through 
a stop sign and hit the tanker truck as was southbound on the 130 service road. The 
impact caused the truck to lose control, and the trailer part of the truck did a 
counterclockwise spin before catching fire. The driver of the tanker truck did not make 
it out. Firefighters said they had to let the fuel that spilled from the tanker bum off and 
that took about 2 hours. The driver of the BMW was transported to a hospital and was 
treated and released. Some fuel from the tanker leaked out and environmental crews 
will clean it up after emergency responders leave the scene. A battalion chief said 
intense heat from the explosion destroyed part of the access road that will need to be 
repaved. 

Source: http://www.mvfoxaustin.com/dpp/news/Tanker-Truck-Crash-Leaves-One- 
Dead-20 1 20328 -ktbc w#axzz 1 qPwRgsXC 

2. March 28, Oklahoma City Oklahoman - (National) EPA proposes rules for carbon 
dioxide emissions from new power plants. New coal-fired power plants will have a 
harder time getting built if they do not include technology that limits carbon emissions 
under proposed rules released March 27 by the U.S. Environmental Protection Agency 
(EPA). The rules would put national limits on the amount of carbon released by power 
plants run by natural gas, coal, or other fossil fuels. However, they would apply only to 
new plants or plants set to begin construction within the next year. The EPA 
Administrator said the rules reflect industry moves toward natural gas as the fuel of 
choice for new electric power plants. The rules will limit future greenhouse gas 
emissions, she said. 

Source: http://newsok.com/epa-proposes-rules-for-carbon-dioxide-emissions-from- 
new-power-plants/article/3661345 

3. March 27, U.S. Environmental Protection Agency - (Kansas) National Cooperative 
Refinery Association to pay $700,000 in penalties for violations at Kansas refinery 
and storage facility. The National Cooperative Refinery Association (NCRA) agreed 
to pay $700,000 in penalties to the United States and the State of Kansas, and perform a 
series of injunctive relief actions, to settle violations of federal environmental laws and 
the Kansas State Implementation Plan at its petroleum refinery and underground 
storage facility in McPherson County, Kansas. As part of a consent decree lodged 
March 26 in federal court, NCRA will pay $475,000 in penalties to the United States 
and $225,000 to the State of Kansas. As a part of the settlement, NCRA agreed to 
spend about $745,000 on supplemental environmental projects involving the purchase 
of emergency response equipment and services for the benefit of citizens and 
emergency response agencies in McPherson County. The NCRA owns and operates an 
85,000-barrel-per-day petroleum refinery in the city of McPherson, and an associated 
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underground product storage facility in the unincorporated community of Conway, 
Kansas. 

Source: 

http://vosemite.epa.gOv/opa/admpress.nsf/0/512beacl43e9b66a852579ce005fc4b47Qpe 

nDocument 



4. March 27, Reuters - (Texas) BP refinery leaks acid in Texas City; no 

injuries. Hydrofluoric acid leaked from an alkylation unit at BP Pic’s 406,570-barrels- 
per-day refinery in Texas City, Texas, March 27, triggering alarms in the plant and 
warnings to area residents, company and city officials said. Water cannons surrounding 
alkylation unit 3 were triggered when monitors detected the leak. Workers in the 
refinery not battling the leak were ordered to shelter in place. The cause of the leak had 
not been determined, and a spokesman declined to say whether gasoline production was 
affected. Hydrofluoric acid can damage skin, eyes, lungs, bones, and the heart in 
humans. Exposure can be fatal, and the acid can form into vapor clouds that are able to 
spread over large distances. 

Source: http://www.reuters.com/article/2012/03/27/us-refinery-operations-bp-texascitv- 
idUSBRE82Q0R820 120327 

For another story, see item 6 



T Return to top i 

Chemical Industry Sector 

5. March 27, Houston Chronicle - (Texas) Houston firefighters rescue men trapped 
inside fertilizer truck. Firefighters in Houston rescued a man overcome by toxic 
fumes inside a fertilizer truck March 27, a Houston Fire Department spokeswoman 
said. Investigators said the man and a co-worker were inside a tank on the mulch truck 
in a warehouse when they became overwhelmed by toxic fumes. One man was able to 
climb out of the tank, but the other had to be rescued, a deputy chief said. Neither 
appeared to be wearing protective gear, officials said. The men were given oxygen and 
transported by ambulance to a local hospital. They did not appear to have serious 
injuries. The spokeswoman said 17 units responded, including the department’s 
HAZMAT team and the rescue team with special equipment. 

Source: http://blog.chron.com/newswatch/2012/03/houston-firefighters-rescue-man- 
trapped-inside-mulch-truck/?plckFindCommentKev=CommentKev:c65e2781-0al7- 
4845-b995-0dd5e708c42d 



For more stories, see items 4, 8, 14, 19, 20, 21, and 33 



T Return to topi 

Nuclear Reactors, Materials and Waste Sector 



6. March 28, Associated Press - (California) Feds: State nuke plant to remain shut for 
probe. The San Onofre nuclear plant near San Diego will remain shut down while 
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investigators try to solve a mystery inside its massive generators — the rapid decay of 
tubing that carries radioactive water, federal regulators said March 27. A four-page 
letter to plant operator Edison from the Nuclear Regulatory Commission regional 
administrator laid out a series of steps the company must take before restarting the 
seaside reactors, underscoring the concern over the unusual degradation in the tubes. 
The administrator wrote that the problems in the generators must be resolved and fixed 
and “until we are satisfied that has been done, the plant will not be permitted to restart.” 
The plant’s 4 steam generators each contain nearly 10,000 alloy tubes that carry hot, 
pressurized water from the reactors. The Unit 3 reactor was shut down as a precaution 
in January after a tube break, and extensive wear was found on similar tubing in its 
twin, Unit 2, which has been shut down for maintenance. 

Source: http://www.smdailviournal.com/article preview.php?id=231350&title=Feds: 
State nuke plant to remain shut for probe 

7. March 27, Associated Press - (International) Very high radiation, little water in 
Japan reactor. One of the crippled nuclear reactors at Japan’s Fukushima nuclear 
power plant still has fatally high radiation levels and much less water to cool it than 
officials had estimated, according to an internal examination conducted March 27. An 
industrial endoscope equipped with a tiny video camera, a thermometer, a dosimeter, 
and a water gauge was used to assess damage inside the No. 2 reactor’s containment 
chamber. The No. 2 reactor is the only one that officials have been able to closely 
examine so far. Radiation levels of to up to 70 sieverts per hour inside the container 
were found, according to a spokesman for Tokyo Electric Power Co. The probe also 
found that the containment vessel had cooling water up to only 60 centimeters (2 feet) 
from the bottom, far below the 10 meters estimated when the government declared the 
plant stable in December. 

Source: http://santamariatimes.com/news/world/very-high-radiation-little-water-in- 
j apan-reactor/article 6208 8f25 - 1 aeb-5 1 67 - 8664-27 60ffe9 1 04f.html 



T Return to top i 

Critical Manufacturing Sector 

See items 8 and 34 
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Defense Industrial Base Sector 

8. March 27, U.S. Department of Labor - (Ohio) U.S. Labor Department’s OSHA 
proposes more than $88,000 in fines to Heritage Industrial Finishing for health 
and safety violations at Akron, Ohio, facilities. The U.S. Department of Fabor’s 
Occupational Safety and Health Administration (OSHA) March 27 cited Heritage 
Industrial Finishing for 26 safety and health violations. OSHA initiated inspections at 
the company’s two Akron, Ohio facilities, which specialize in commercial/industrial 
and powdered coating applications, after receiving complaints about workplace 
hazards. Eight serious safety violations and four serious health violations were cited at 
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the company’s Englewood Avenue facility. Thirteen serious health violations were 
found at the Kelly Avenue facility. 

Source: 

http://www.osha.gov/pls/oshaweb/owadisp.show document?p table=NEWS RELEAS 
ES&p id=22068 



T Return to top i 

Banking and Finance Sector 

9. March 27, Bloomberg - (California; National) SEC sues former United Commercial 
Bank executive. The Securities and Exchange Commission (SEC) sued a former 
United Commercial Bank vice president (VP) March 27, accusing him of creating false 
records tied to the defunct San Francisco-based bank’s evaluation of loan risks. United 
Commercial, a unit of UCBH Holdings Inc., was seized by regulators in November 
2009. It failed following the 2008 credit crisis and caused a $2.5 billion loss to the 
Federal Deposit Insurance Corporation’s insurance fund, according to the SEC. The VP 
was in charge of the bank’s commercial banking division, the SEC said. The VP, taking 
orders from his superiors during the financial crisis, “misstated and omitted material 
information in documents provided to the bank’s independent auditors,” the SEC said 
in its complaint. He “altered memoranda addressing the risks associated with certain 
large loans and the potential losses the bank faced from the loans,” which auditors 
relied on, according to the complaint. Three former executives at the bank were sued by 
the SEC in 201 1 over claims they misled investors by concealing at least $65 million in 
loan losses before the lender collapsed. 

Source: http://www.bloomberg.com/news/2012-03-27/sec-sues-former-united- 
commercial-bank-executive-cinderey- 1 -.html 

10. March 27, Burlington Free Press - (Connecticut; Vermont) Chiropractor pleads not 
guilty to $28 million investment fraud scheme. A Connecticut chiropractor was 
accused of being a silent partner, but prime beneficiary, in an alleged $28 million 
investment fraud scheme, the Burlington Free Press reported March 27. A renowned 
Vermont storyteller was a central fundraiser in the case. According to a federal 
indictment, the chiropractor induced the Vermont man to raise $28 million for for a 
still-unreleased film. The chiropractor, who was arrested in Connecticut the week of 
March 19, pleaded not guilty to an 18-count indictment March 27 in a U.S. district 
court in Burlington, Vermont. He is facing nine wire fraud counts, five mail fraud 
counts, three money laundering counts, and a single conspiracy count. Court documents 
allege that most of the investor money the Vermonter raised for the film went to pay off 
earlier investors. Some of the remainder went into the film project, but an estimated 
$3.8 million was diverted to the chiropractor. The Vermont man pleaded guilty the 
week of March 19 to conspiracy to commit wire fraud, and one count of filing a 
fraudulent tax document. He has agreed to cooperate with the government’s case. 
Source: 

http://www.burlingtonfreepress.com/article/20120327/NEWS02/120327019/Chiropract 

or-pleads-not-guilty-28-million-investment-fraud-scheme 
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11. March 27, Manchester Union Leader - (New Hampshire) Prosecutors: NH mortgage 
scam stiffed homeowners. A man accused of running a mortgage scam that duped 
dozens of people into believing they were saving their homes while he pocketed loan 
proceeds that he never repaid was on trial March 27 in a U.S. district court in New 
Hampshire. According to an indictment, the man approached people who were 
struggling to make mortgage payments from 2005 to 2008. He would offer to take the 
deed to their property while allowing them to stay in the home. According to 
prosecutors, part of his scheme would have them pay rent while offering them an 
option to buy their homes back in 2 years. Instead, he leveraged the properties to take 
out more loans and would also use agents, or “straws,” who would pose as purchasers 
and take out mortgages to buy homes from the man’s companies. The loans, which 
totaled more than $13 million, were never repaid, prosecutors allege. The defendant 
paid associates and straws with the money, and pocketed much of it, spending it for 
personal expenses. “When [he] later defaulted on the mortgages and the homes went to 
foreclosure, the distressed homeowners were not notified because the straws were the 
owners of record,” the indictment alleged. Meanwhile, the defendant continued 
collecting rent payments from the homes’ former owners, the indictment said. 

Source: http://www.unionleader.com/article/20120327/NEWS03/703289979 

For more stories, see items 29, 36, and 39 



T Return to top ] 

Transportation Sector 

12. March 28, CNN; KOVR 13 Sacramento - (California) Greyhound bus catches 
fire. March 28, a Greyhound bus caught fire traveling from Sacramento, California. 
The bus driver was unsure how the bus caught on fire but said another driver saw the 
fire when they were at a light and pounded on the window to tell him. Some of the 
passengers said they smelled something odd and asked the driver to pull over. He did 
about a block away from the Stockton, California station. The driver said it looks like a 
mechanical failure caused the fire. 

Source: http://www.kplctv.com/story/17272364/grevhound-bus-catches-fire 

13. March 28, Chicago Tribune - (New York; Texas) New details emerge about Jet Blue 
pilot’s midair meltdown. Jet Blue identified the pilot who began ranting and acting 
erratically as his flight headed from New York to Las Vegas, forcing the co-pilot to 
lock him out of the cockpit and make an emergency landing. Jet Blue said in a 
statement March 27 the captain of Flight 191 was receiving medical treatment. The 
flight landed in Las Vegas March 27 after initially making an emergency landing in 
Amarillo, Texas, where the captain was removed from the flight after having been 
tackled by passengers and strapped down with their belts. The co-pilot managed to 
persuade the pilot to leave the cockpit, then quickly locked him out of the cockpit and 
changed the security code to prevent the captain from re-entering. As the co-pilot 
declared an emergency and made plans to land in Amarillo, chaos erupted in the jet’s 
cabin, according to passengers’ accounts and video taken by several people on board. 
Passengers leaped on top of the pilot after a flight attendant called for help; according 
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to WABC 7 New York City, many of those on board were security professionals 
headed to Las Vegas for a convention, which enabled them to effectively use a choke- 
hold to subdue the captain and restrain him for more than 20 minutes. 

Source: http://www.chicagotribune.com/news/nationworld/la-na-nn-jet-blue-pilot- 
20120328,0,478370.story 

14. March 28, Fort Wayne Journal Gazette - (Indiana) Derailment, fire prompt 
evacuation near Ligonier. Officials said a heavily traveled stretch of railroad in 
northeastern Indiana would likely be closed through March 28, a day after a freight 
train derailed and spewed molten sulfur that caught fire. Firefighters were still at the 
site near Ligonier March 28 monitoring the fire caused after 21 cars of the eastbound 
59-car Norfolk Southern train derailed. The Noble County sheriff said firefighters 
decided to let the cars burn because water could wash the chemical into the Little 
Elkhart River. He said the fire was expected to bum until at least noon March 28. Up to 
100 trains, including two Amtrak passenger trains, use the route daily, Norfolk 
Southern said. It said that trains that normally use the route have been rerouted with 
other carriers and alternate routes. The train that derailed had 3 locomotives, 43 cars 
loaded with freight, including 1 1 with hazardous materials such as molten sulfur and 
toluene, and 16 empty freight cars. The derailment forced detours of two Amtrak trains 
carrying about 400 passengers combined. It also forced the evacuation of about six 
homes in the rural area. 

Source: 

http://www.iournalgazette.net/article/20120328/LOCAL07/303289978/1043/LQCAL0 

7 

For more stories, see items 1, 22, and 34 



T Return to topi 

Postal and Shipping Sector 

Nothing to report 



T Return to top ] 

Agriculture and Food Sector 

15. March 28, Occupational Health & Safety - (Georgia) Poultry processing plant 
penalized for 11 safety violations. The Occupational Safety and Health 
Administration (OSHA) cited poultry processor KD Acquisition I LLC, doing business 
as Coleman Natural Foods, with 11 safety violations, Occupational Health & Safety 
reported March 28. The OSHA opened an inspection at the KD4 processing plant in 
Gainesville, Georgia, after receiving a complaint in September 2011 about safety 
hazards. Proposed penalties total $187,100. Two repeat violations, each carrying a 
$70,000 fine, include allowing untrained workers to assist with and perform conveyor 
belt adjustments and operate the conveyor belt system without machine guards that 
would protect workers from rotating parts, flying chips, and sparks. Similar violations 
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were cited at the company’s KD5 plant in Braselton, Georgia, in 2007. Eight serious 
violations, with penalties of $47,100 were also issued. In January, the OSHA again 
cited the Braselton plant for eight violations with $142,150 in proposed fines. “KD 
Acquisitions has a history of endangering its workers by exposing them to serious 
safety and health hazards that must be corrected before a worker is seriously injured,” 
said the director of the OSHA Atlanta-East Area Office. 

Source: http://ohsonline.com/articles/2012/03/28/poultrv-processing-plant-penalized- 
for- 1 1 - s afet y- violations . aspx?admgarea=ne w s 

16. March 28, Food Safety News - (New York; Massachusetts; Pennsylvania) Allergen 
alert: Dried potato with sulfites. Strong America Ltd. is recalling a dried potato 
product imported from China that may contain sulfites, which are not listed on the 
label, Food Safety News reported March 28. According to the notice, the recall was 
initiated after routine sampling by New York State Department of Agriculture and 
Markets Food Inspectors, and subsequent analysis by food laboratory personnel 
revealed the presence of sulfites in the product which were not declared on the label. 
The consumption of 10 milligrams of sulfites per serving has been reported to elicit 
severe reactions in some asthmatics. Anaphylactic shock could occur in certain sulfite- 
sensitive individuals upon ingesting 10 milligrams or more of sulfites. Analysis of the 
“Dried Potato” revealed it contained 36 milligrams per serving. The recalled dried 
potato is packed in 6-ounce packages under the brand name Golden Smell and was sold 
in New York, Massachusetts, and Pennsylvania. 

Source: http://www.foodsafetvnews.com/2012/03/allergen-alert-dried-potato-with- 
sulfites/ 



17. March 27, Ottawa Citizen - (International) Caterer fires staffer for ‘breach of 
protocol’ leading to salmonella outbreak. The school-lunch caterer implicated in a 
salmonella outbreak in Ottawa, Ontario, Canada, that sickened dozens of children fired 
a staffer for a “breach of protocol” in the kitchen where contaminated beef was 
prepared, the company’s owner wrote to parents March 26. “The Lunch Lady Group 
guidelines on handling raw meat and poultry were not properly followed by one 
individual,” wrote the owner. “This person had the responsibility for ensuring that safe 
food handling guidelines were followed to the letter. This person is no longer working 
in my kitchens.” One Lunch Lady kitchen is believed to be the source of an outbreak 
that sickened 49 children and 5 adults in Ottawa, and 1 person in Kanata. That location 
is staying closed the week of March 26 for a top-to-bottom sterilization. The 
department found salmonella in beef and chicken stored in the kitchen. The health 
department’s investigation found meat lasagna and beef tacos to be the common 
threads in the salmonella cases confirmed by labs as being connected to the outbreak, 
which came to the department’s attention about 2 weeks ago. 

Source: 

http://www.ottawacitizen.com/health/Caterer+fires+staffer+centre+salmonella+outbrea 

k/6365648/story.html 

18. March 27, Muscatine Journal - (Iowa) GPC gets violation notice from EPA. The 
U.S. Environmental Protection Agency (EPA) sent a notice of violation to Grain 
Processing Corp. (GPC) in Muscatine, Iowa, March 27, alleging the company violated 
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air emission limits as well as reporting and certification requirements under the federal 
Clean Air Act. The notice of violation outlines specific violations at the GPC facility 
from 2007 to 201 1 . The second portion of the EPA action, issued by the director of 
EPA’s Kansas City-based Air and Waste Management Division, requires the company 
to provide the agency with information about GPC’s compliance with the Clean Water 
Act. In May 2011, GPC announced it would spend $100 million to substantially clear 
Muscatine’s air of sulfur dioxide and small particle emissions. The company has begun 
construction of a $75 million, state-of-the-art dryer at the plant site along the 
Mississippi River and will spend $20 million to upgrade environmental control systems 
for its boilers. The remaining $5 million will be spent on programs that further reduce 
the company’s carbon footprint in Muscatine. 

Source: http://muscatineiournal.com/news/local/gpc-gets-violation-notice-from- 
epa/article 15b560a4-7843-l Iel-a302-0019bb2963f4.html 

For more stories, see items 5, 20, and 23 
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Water Sector 



19. March 28, Culpeper Star Exponent - (Virginia) Town to pay $27K fine for 2008 
chlorine gas leak. The town of Culpeper, Virginia, must pay a $27,420 civil penalty to 
the U.S. Environmental Protection Agency (EPA) for violations related to a 2008 
accidental chlorine gas leak at the sewer treatment plant, the Culpeper Star Exponent 
reported March 28. In a November 15, 201 1 letter, the EPA said the town failed to 
immediately notify the National Response Center and state emergency response 
commission of the chlorine leak and did not provide written follow-up reports to state 
and local emergency officials “as soon as practicable.” The town also failed to have 
written safety procedures in place in dealing with the potentially lethal gas. As part of 
the recently reached settlement agreement, the town is required to install a Sodium 
Hypochlorite system to replace the chlorine disinfectant system at the water plant. The 
town originally faced a fine from the EPA of more than $160,000 related to the 
chlorine gas leak. 

Source: http://www2.starexponent.com/news/2012/mar/28/town-pay-27k-fine-2008- 
chlorine- gas -leak- ar- 1 7 9 964 8/ 

20. March 27, KCAU 9 Sioux City - (Iowa) Peracetic acid mistakenly flows into Storm 
Lake. A large amount of peracetic acid was released into Storm Lake in Iowa March 
26. An Iowa Department of Natural Resources (DNR) press release showed 5,000 to 
10,000 gallons of chiller water containing MicroTox, a peracetic acid, was mistakenly 
released from Sara Lee Foods. The water flowed across the parking lot and some 
entered several storm sewer intakes, storm water ponds in Radio Park, and eventually 
discharged into Storm Lake. The release of chiller water was diverted to the 
pretreatment wastewater plant as soon as the release was discovered. Testing of the 
chiller water in the parking lot at Sara Lee revealed a 2 parts per million level of 
MicroTox, and a pH of 7.08. The DNR was monitoring the situation. 

Source: http ://w w w .kcautv .com/story/ 1 7265649/parasitic-acid-mistakenl y 
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21. March 27, Associated Press - (California) Officials set LA waterway pollution 
reduction plan. The U.S. Environmental Protection Agency (EPA) and the Los 
Angeles Regional Water Quality Control Board agreed March 27 to a strict new 
pollution reduction plan to eliminate beach closures and reduce trash and toxic 
chemicals in 175 Los Angeles area waterways. The plan intends to restore ecosystems 
and protect the public, said an EPA spokeswoman. The pollution plans call for 
reductions of bacteria, nitrogen, phosphorus, mercury, pesticides, and other toxic 
chemicals in a wide-ranging array of creeks, streams, and beaches in Los Angeles and 
Ventura counties. 

Source: http://www.sacbee.com/2012/03/27/4371397/officials-set-la-waterway- 
pollution.html 

22. March 26, Basehor Sentinel - (Kansas) Work on failed wastewater pipes will 
continue this week in Bonner. A force main carrying wastewater under Kansas 
Highway 32 to Bonner, Kansas’ wastewater plant burst March 20. The work to replace 
the 100-foot steel wrapped pipe required two lanes of the street to be closed and 
uncovered a clog inside another force main in the same area. The utilities director said 
the force main caused a manhole cover to fly several feet in the air. Attempts to replace 
the pipe with plastic on March 20 and 21 were delayed because they required larger 
equipment and more manpower, so the city called in a contractor. The week of March 
26, contractors planned to bore a new wastewater line. During the closure, wastewater 
from the pump station at Front Street and Scheidt has been bypassed into Spring Creek, 
which feeds into the Kansas River. Officials said the plastic pipe is expected to last 60 
to 80 years. 

Source: http://www.basehorinfo.com/news/2012/mar/26/work-failed-wastewater-pipes- 
will-continue- week-bo/ 



23. March 26, WBIR 10 Knoxville - (Tennessee) New River remains under advisory 
after sewage spill. After more E. coli testing, an advisory remained in effect on the 
New River March 26 from the Huntsville Wastewater Facility to Big South Fork in 
Tennessee. The advisory began March 21 when Tennessee Department of Environment 
and Conservation (TDEC) said untreated sewage flowed into the river after a pump 
failure. Testing March 26 showed E. coli levels still higher than normal, but officials 
said they would continue checking throughout the remainder of the week. State 
officials warned people not to boat, swim or fish in New River downstream from mile 
14.8 near Huntsville. 

Source: http://www.wbir.eom/news/article/2 12648/2/New-River-remains-under- 
advisory-after-sewage-spill 

24. March 26, Twin Falls Times-News - (Idaho) Operator error caused wastewater 
discharge. Wastewater discharges into the J Canal in December 2010 and January 
2011 resulted from city operator error rather than transgressions by private industry, 
Jerome, Idaho officials said in a news release March 23. The mayor and the city council 
determined no actions by Jerome Cheese Co., Darigold, or Idaho Milk Products 
contributed to the discharge. The overflow issues occurred when the wastewater plant’s 
membrane filtration system was clogged by a foreign substance. Officials initially said 
the overflow was caused by calcium discharge by an industrial source, but later 
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recanted. The news release said safeguards “have been and are being devised” to ensure 
another discharge does not occur. The news released added the city is currently 
conducting an analysis by professional engineers to implement a wastewater master 
plan. The goal is to identify and implement all needed improvements to all wastewater 
facilities. 

Source: http://magicvallev.com/news/local/northside/operator-error-caused- 
wastewater-discharge/article bl5a76e3-3be9-51d4-862c-40c2cf9774bb.html 

For another story, see item 14 
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Public Health and Healthcare Sector 



25. March 28, Associated Press - (Washington, D.C. ) Howard University Hospital says 
laptop containing patient information was stolen in January. Howard University 
Hospital in Washington, D.C., said a former contractor’s personal laptop containing 
patient information was stolen in January, the Associated Press reported March 28. The 
week of March 26, the hospital sent letters to more than 34,000 patients affected by the 
breach. The records held personal information, including Social Security numbers. The 
former contractor downloaded the files to a personal laptop in violation of hospital 
policy and federal health care rules. The laptop was password protected, and there is no 
evidence the patients’ files were violated. 

Source: http://www.washingtonpost.com/local/howard-universitv-hospital-savs-laptop- 

containing-patient-information-was-stolen-in- 

ianuary/2012/03/28/gIQANoRyfS story.html 

26. March 27, Associated Press - (California) Mental facility in eighth day of 
lockdown. Atascadero State Hospital in Atascadero, California, remained locked down 
8 days after an outbreak of violence at the central coast mental facility. March 27, a 
spokesman said the lockdown was in place as a precautionary measure since March 20, 
with the exception of a few hours March 21. A lockdown means patients are kept inside 
their sleeping and living units, and visitors are not allowed. The lockdown is designed 
to protect patients and state hospital employees. The multiple March 20 violent 
incidents involved patients and employees. Officials did not provide any further details. 
Source: http://www.kget.com/news/state/story/Mental-facilitv-in-eighth-dav-of- 
lockdown/EVrurNb4ZkCxZ3M9G3aGZg.cspx 

27. March 27, WAVE 3 Louisville - (Indiana) Hospital employee charged with identity 
theft. A nurse’s aide at Floyd Memorial Hospital in New Albany, Indiana, was arrested 
after being accused of using patient information to apply for credit cards, WAVE 3 
Louisville reported March 27. Clarksville police said the nurse worked at the hospital 
when she took several patients’ information and applied for several credit cards in their 
names. 

Source: http://www.wave3.com/story/17265260/hospital-employee-charged-with- 
identity-theft 
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28. March 27, Associated Press - (Minnesota) Head of Minnesota security hospital 
forced out. The Minnesota Department of Human Services forced out the head of 
Minnesota Security Hospital in St. Peter, the state’s largest hospital for the mentally ill 
and dangerous, the Associated Press reported March 27. He was hired in August 2011 
but came under criticism in recent months for allegedly creating a hostile work 
environment. The human services department opened an investigation into the 
allegations December 2011. The report finds claims that he created a hostile work 
environment or harassed any employees were unsubstantiated, although he was loud 
and intense during staff meetings. 

Source: http://www.news8000.com/news/Head-of-Minnesota-security-hospital-forced- 
out/-/326/9722752/-/q j ybbcz/Vindex .html 

For another story, see item NaN 
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Government Facilities Sector 



29. March 28, Associated Press - (California) Calif. Democratic treasurer perpetrated 
$7M fraud. A Democratic campaign treasurer in California defrauded at least 50 
candidates, officeholders, and political organizations out of $7 million in a scheme that 
dates back more than a decade, according to a court filing made March 27 by federal 
prosecutors in Sacramento, California. The U.S. attorney’s office in Sacramento filed 
the additional charges in federal court, providing the most detailed account in a case 
that has left some Democratic candidates scrambling for campaign cash in an election 
year. The head of Durkee & Associates in Burbank, was arrested in September 2011 
and charged with suspicion of mail fraud after millions of dollars disappeared from 
campaign accounts of a U.S. Senator, other Democratic members of Congress, and 
several Democratic state lawmakers. The filing details a complex shell game in which 
the treasurer allegedly shifted campaign money to cover personal and business 
expenses. 

Source: http://www.sacbee.com/2012/03/27/4371582/prosecutors-filing-hints-at- 
plea.html#storylink=omni popular 

30. March 27, Deseret News - (Utah) Carbon monoxide scare at Heber City elementary 
school. Seventeen students and a teacher were treated at a local hospital March 27 after 
a carbon monoxide scare at Heber Valley Elementary School in Heber City, Utah. All 
18 have been released, said a hospital spokeswoman. The incident was apparently 
caused by construction equipment being used to build additional classrooms, said a 
Wasatch County Fire Department lieutenant. Carbon monoxide exhaust entered 
through a side door, setting off smoke alarms. At that time, the school was evacuated 
and the fire marshal checked carbon monoxide levels throughout the building, where it 
was found only between the two sets of double doors at the side entrance, she said. 
However, several hours later, children began complaining of stomach aches and 
headaches and Wasatch County fire, EMS, and health department officials responded to 
the school to check students and staff with monitors. The monitors are similar to 
oximeters used to test for blood oxygen levels and take around 30 seconds to a minute 



- 12 - 



per test. Construction was halted at the school until the safety of students and staff can 
be assured. 

Source: http://www.deseretnews.com/article/865553004/Carbon-monoxide-scare-at- 
Heber-Citv-elementary-school.html 



31. March 27, Associated Press - (Georgia) Georgia man pleads guilty to making bomb 
threat at Colquitt County building. A man has pleaded guilty to making a bomb 
threat at a Colquitt County, Georgia school. The U.S. attorney’s office said March 27, 
the man pleaded guilty to calling Colquitt County authorities and claiming he put a 
bomb in an unnamed county building. All Colquitt County schools were evacuated for 
the day for safety reasons as the result of the call. The man could face 10 years in 
prison and a $250,000 fine when he is sentenced in July. 

Source: 

http ://w w w .therepublic .com/view/story/7 e4d7 d2e 8 1 7b43 1 28d83fcdd 1 5c04c02/GA— 
Bomb-Threat/ 



For another story, see item 42 
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Emergency Services Sector 

32. March 28, Sunbury Daily Item - (Pennsylvania) Pennsylvania firefighters charged 
with arson. March 26, two members of the Potts Grove Fire Department were charged 
with arson and related counts involving a January 12 fire in an abandoned home in the 
Liberty Township section of Montour County, Pennsylvania. State police also told the 
district judge the two would be charged with setting three other fires in Montour 
County, two arsons, and an attempted arson in Northumberland County, and with 
making five false reports in Union County. 

Source: http://www.firehouse.com/news/10683983/pennsylvania-firefighters-charged- 
with-arson 



33. March 27, Associated Press - (California) Safety expert praises 2010 burning of 
bomb house. A safety expert said the burning of a house packed with bomb-making 
chemicals in San Diego County went so well that safety professionals nationwide use it 
as a model, the Associated Press reported March 27. The North County Times said a 
spokesman praised the operation March 26 at an American Chemical Society 
convention in San Diego. Authorities burned the Escondido-area home in 2010 after 
deciding it was too dangerous to remove bomb components, thousands of rounds of 
ammunition, and stockpiles of unstable chemicals that could go off with a tap. Sixty 
agencies were involved and the unprecedented operation went off without injury or 
contamination. 

Source: http://www.mercurvnews.com/news/ci 20264500/safetv-expert-praises-20 10- 
burning-bomb-house 

34. March 27, Associated Press - (Oregon) GE engine faulted for crash that killed 9. A 
Portland, Oregon jury ruled March 27 a problem with an engine was responsible for the 
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2008 crash of a helicopter that killed nine firefighters and injured four people during a 
wildfire in Northern California. The jury reached its verdict after a pilot who survived 
and the widow of one who was killed sued General Electric (GE) for $177 million. The 
plaintiffs argued the company knew the engines it made for the Sikorsky S-61N 
helicopter had a design flaw making them unsafe. GE argued the helicopter crashed 
because it was carrying too much weight when it took off after picking up a firefighting 
crew on the Iron 44 wildfire on the Shasta-Trinity National Forest near Weaverville, 
California. The chopper was airborne less than a minute when it clipped a tree and fell 
from the sky, bursting into flames. After a 2-year investigation, the National 
Transportation Safety Board concluded in 2010 that too much weight and a lack of 
oversight caused the crash. The jury March 27 awarded a combined $69.7 million to 
the estate of a pilot and two of the survivors. The jury put most of the blame — 57 
percent — on GE, but also found the helicopter’s owner and its manufacturer partially 
at fault. 

Source: http://www.sfgate.com/cgi- 

bin/article . c gi?f=/n/a/20 1 2/03/27 /national/a 121021D72.DTL 
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Information Technology Sector 

35. March 28, Threatpost - (International) Adobe patches Flash Player, unveils new 
silent updater. Adobe released a security update for its Flash Player March 28, 
patching two critical holes and introducing a new silent update option. The update, 
Adobe Flash Player 1 1.2, addresses two memory corruption vulnerabilities in 
Windows, Mac, Linux, and early Android builds that could lead to remote code 
execution according to a bulletin (APSB 12-07). Users updating to 11.2 on Windows 
machines will notice a new background updater for Flash that has been shipped with 
the patch. After users update Flash, they will be asked how they want to receive Adobe 
updates going forward. The updater gives three options, including one that will 
automatically install updates in the background. If selected, the updater will check with 
Adobe every hour until it receives a response. If there is no available update, the 
updater will check back 24 hours later. 

Source: http://threatpost.com/en us/blogs/adobe-patches-flash-player-unveils-new- 
silent-updater-0328 12 

36. March 28, Threatpost - (International) Kaspersky knocks down Kelihos botnet 
again, but expects return. For the second time in 6 months, researchers from 
Kaspersky Lab carried out an operation to take down the newest iteration of the 
Kelihos botnet, also known as “Hlux.” Microsoft and Kaspersky worked together in 
September, 2011, on the first Kelihos take-down. The bot then resurfaced in January 
only to be shut-down again in March by a combination of private firms including 
Kaspersky, Dell Secure Works, and Crowd Strike Inc. Kelihos is used to send spam, 
carry out distributed denial-of-service attacks, and steal online currency such as bitcoin 
wallets. It operates as a “peer-to-peer” bot network, which are more difficult to take 
down than those with centralized command and control (C&C) servers, according to a 
senior researcher at CrowdStrike. Peer-to-peer botnets are distributed, self-organizing, 
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and may have multiple command and control servers that disguise themselves as peers. 
In Kelihos’s case, there were three C&C servers and each had two unique IP addresses, 
he said. 

Source: http://threatpost.com/en us/blogs/kaspersky-sinkholes-kelihos-botnet-again- 
expects-resurrection-0328 1 2 

37. March 28, H Security - (International) Opera 11.62 closes security holes. Opera 
released version 11.62 of its Web browser. This maintenance update fixes a number of 
bugs, improves overall stability, and closes seven security holes, five of which affect all 
supported platforms. Two of the vulnerabilities are rated as “high” severity and could 
be exploited by an attacker to download and execute a possibly malicious file. This is 
done by tricking a victim into clicking a hidden dialogue box or by entering a specific 
keyboard sequence. Three other problems rated as “low” severity, including an address- 
spoofing bug, an address-bar problem and a cross-domain information disclosure bug, 
were also fixed. A moderate vulnerability affecting Opera for Mac and a low risk bug 
on Linux/Unix were also corrected. 

Source: http://www.h-online.com/security/news/item/Opera-ll-62-closes-securitv- 
holes-1485067.html 



38. March 28, H Security - (International) Critical Java hole being exploited on a large 
scale. Criminals are increasingly exploiting a critical hole in the Java Runtime 
Environment to infect computers with malicious code when users visit a specially 
crafted Web page. According to a security blogger, the reason for this increased activity 
is that the arsenal of the BlackHole exploit kit has been extended to include a suitable 
exploit. The hole patched by Oracle in mid-February allows malicious code to breach 
the Java sandbox and permanently anchor itself in a system. Varying types of malware 
are injected; for example, it is believed the hole is exploited to deploy the Zeus trojan. 
According to an analysis by Microsoft, the dropper is distributed across two Java 
classes. The first class exploits the vulnerability to elevate its privileges when 
processing arrays, and then executes a loader class that will download and install the 
payload. Users can protect themselves by installing or updating to one of the current 
Java releases: Java SE 6 Update 31 or version 7 Update 3. 

Source: http://www.h-onhne.com/security/news/item/Critical-Java-hole-being- 
exploited-on-a-large-scale- 148568 1 .html 

39. March 27, Threatpost - (International) Carberp: It’s not over yet. March 20, Russian 
law enforcement agencies announced the arrest of a cybercriminal gang involved in 
stealing money using the Carberp trojan. Evidently, those arrested were just one of the 
criminal gangs using the trojan. At the same time, those who developed Carberp are 
still at large, openly selling the trojan on cybercriminal forums. There are still 
numerous “affiliate programs” involved in the distribution of Carberp, particularly 
“traffbiz(dot)ru.” In short, those responsible for developing Carberp remain at large and 
the cybercriminal gangs using the trojan remain active. 

Source: http://threatpost.com/en us/blogs/carberp-it-s-not-over-yet-032712 

40. March 27, Dark Reading - (International) Malware to increasingly abuse 
DNS. Security researchers have looked at ways to abuse the domain-name service 
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(DNS) for years. Now, some researchers are warning the protocol may increasingly be 
used to help criminals communicate with compromised systems. At the RSA 
Conference in February, a senior security consultant with InGuardians predicted more 
malware would hide its commands and exfiltrated data in DNS packets. The advantage 
for malware writers is that, even if a company bars a potentially infected computer 
from contacting the Internet, malware could send DNS requests to a local server, which 
would then act as a proxy, bypassing defenses. To date, the tactic has been relatively 
rare: Perhaps a dozen malware variants have used the domain-name system to send 
commands and updates to botnets. 

Source: http://www.darkreading.com/advanced- 

threats/1 6790109 l/security/vulnerabilities/232700369/malware-to-increasingly-abuse- 
dns.html 



41. March 27, CNET News - (International) New exploit uses old Office vulnerability for 
OS X malware delivery. Some malware groups have recently been found to be taking 
advantage of an old, patched vulnerability in Microsoft Office for OS X in an attempt 
to spread command- and-control malware to OS X systems. The vulnerability used in 
the attack was outlined in a Microsoft security bulletin in June 2009, which applied to 
all versions of Office 2004 version 1 1.5.4 or earlier, Office 2008 version 12.1.8 or 
earlier, and OpenXML Converter 1.0.2 or earlier. The vulnerability was patched soon 
after it was found and currently all supported Office programs are well beyond these 
versions. However, malware developers are attempting to exploit unpatched systems. 
These efforts mark the first time Office documents have been used as a vehicle for 
attacks in OS X. For this attack to work, a person would need to open a maliciously 
crafted Word file that has likely been distributed via spam and other suspicious means 
that could easily be avoided. When a maliciously crafted Word file is opened in an 
unpatched version of Word for Mac, it runs a script that writes the document’s malware 
payload to the disk and executes a shell script that runs the malware. In addition, it 
displays a Word document containing a poorly formatted political statement about 
Tibetan freedoms and grievances. 

Source: http://reviews.cnet.com/8301-13727 7-57405503-263/new-exploit-uses-old- 
office-vulnerability-for-os-x-malware-delivery/?part=rss&subj=news&tag=2547-l 3- 
0-20 



For more stories, see items 25 and 42 
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Analysis Center) Web site: https://www.it-isac.org 
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Communications Sector 



42. March 28, Taos News - (New Mexico) Gunshot blamed for Taos cell phone, 

Internet outage. A gunshot was identified as the cause of a cell phone and Internet 
outage that affected an estimated 7,800 residents in Taos, Questa, Penasco, Red River, 
Eagle Nest, Angel Fire, Cimarron, and Raton, New Mexico. The outage began just 
before 7 p.m. March 24. Service was restored by midday March 25. The loss of service 
was the result of a bullet that apparently cut an overhead fiber optic cable owned by 
Century Link. Several Internet providers and cell phone companies that serve Taos lease 
space on the same cable. E-mailed outage updates provided by the Public Regulation 
Commission showed CenturyLink reported that 7,774 residential, business, and 
government customers were impacted by the cut line. Outage updates from 
CenturyLink stated that mobile phone customers with Verizon, AT&T, and Sprint all 
went without service because of the break. 

Source: http://www.taosnews.com/article 5d792538-783e-llel-b684- 
0019bb2963f4.html 



For another story, see item 35 
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Commercial Facilities Sector 

43. March 28, Associated Press - (Pennsylvania) Pa. apartment fire that left 9 homeless 
was arson. A state police fire marshal said an apartment building fire that left nine 
people homeless in Jeannette, Pennsylvania, was intentionally set, making it the 12th 
arson or suspicious fire in the city since October 2011. The fire in Jeannette was 
reported March 27. The residents got out of the building, though one woman fell and 
broke her arm running down the front porch steps to get out. A Jeannette fire captain 
said the building appeared to be a total loss. The building contained four apartment 
units. 

Source: http://www.timesonline.com/news/state/pa-apartment-fire-that-left-homeless- 
was-arson/article 1 1 75ead0-52b0-5756-bccc-7f7 1 eab9eeaf.html 

44. March 28, WRAL 5 Raleigh - (North Carolina) Fayetteville condo fire displaces 
dozens. At least 29 people were displaced from a Fayetteville, North Carolina 
condominium building March 28 after fire ripped through a dozen units, authorities 
said. Six of those units were heavily damaged, and it appeared that all 12 were no 
longer inhabitable. Investigators said it appeared the fire started accidentally on a 
balcony, but the exact cause was unknown. It took fire officials about 2 hours to put out 
the fire. No one was killed or seriously hurt in the blaze. Red Cross officials were 
assisting the displaced families. 

Source: http://www.wral.com/news/news briefs/story/ 109 14731/ 



45. March 28, WAG A 5 Atlanta - (Georgia) SWAT standoff at Norcross apartment ends 
with man in custody. A SWAT standoff at a Norcross, Georgia apartment complex 
where a man barricaded himself ended peacefully March 28. Police received a call 
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from a frightened woman and arrived to find her running out of the apartment, covered 
in blood. Inside, police said they found a man who refused to give himself up. They 
tried to negotiate with him for some time, and the SWAT team was then called to the 
scene. After a fewl hours, negotiators threw tear gas into the apartment. Authorities 
said the man then surrendered peacefully. The man and the woman who called police 
were taken to a hospital to be checked out. 

Source: http://www.mvfoxatlanta.com/dpp/news/local news/SWAT-Situation-at- 
Norcross-Apartment-Complex-20120328-am-sd 

For more stories, see items 21, 23, 33, 42, and 46 
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National Monuments and Icons Sector 



46. March 28, Associated Press - (National) Colo, gov to stop prescribed burns after 
wildfire. The Colorado governor said March 28 he was preparing to order a stop to 
government-prescribed bums like the one that may have caused a deadly wildfire that 
destroyed dozens of homes near Denver. Investigators were trying to determine 
whether the fire reignited from a controlled bum that was meant to reduce vegetation 
that could fuel a devastating blaze around homes and watersheds. Meanwhile, some 
400 firefighters from several states were focusing on building containment lines around 
the 6-square-mile wildfire, which broke out March 26. Until now, the fire’s erratic 
pattern has forced firefighters to focus on protecting homes, not stopping the bum. As 
crews dig lines around the fire’s perimeter, a search team is using dogs to look for a 
woman missing in the fire zone. Her home was among 27 destroyed or damaged in the 
blaze. The Jefferson County sheriff’s office will determine the cause of the blaze, while 
the Colorado State Forest Service was conducting its own review. 

Source: http://www.seattlepi.com/news/article/Colo-gov-to-stop-prescribed-bums- 
after- wildfire-3436 1 97 .php 

47. March 27, Reuters - (Arizona) Two cousins plead guilty over Arizona’s largest 
fire. Two cousins accused of starting the largest wildfire ever recorded in Arizona by 
leaving a campfire unattended pleaded guilty to two misdemeanor charges March 27 in 
a deal with federal prosecutors. The massive summer blaze, which raged from late May 
201 1 to early July 2011, destroyed three dozen homes and businesses, forced as many 
as 10,000 people to flee, and ravaged pristine property in the picturesque White 
Mountains. More than $83 million was spent fighting the fire before it was finally 
contained July 8, 201 1. March 27, the pair entered guilty pleas before a federal 
magistrate in Flagstaff to two misdemeanor counts each of leaving an unattended fire, 
and failing to remove all flammable material around the campfire. 

Source: http://www.reuters.com/article/2012/Q3/28/us-usa-arizona-fire-plea- 
idUSBRE82R03U20120328 



For another story, see item 34 
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Dams Sector 



48. March 28, Associated Press - (Louisiana) Corps monitors levees as waters rise on 
river. The U.S. Army Corps of Engineers began monitoring the levees along the 
Mississippi river in Louisiana, the Associated Press reported March 28. The Corps said 
patrolling began between Baton Rouge and the mouth of the Mississippi because water 
levels had risen to 1 1.7 feet at the gauge at Carrollton. The agency said inspections 
would continue twice weekly until the water level drops. The National Weather Service 
predicted a crest of 12 feet there April 5. 

Source: http://www.sunherald.com/2012/03/28/3847135/corps-monitors-levees-as- 
waters.html 



49. March 27, KOLR 10 Springfield - (Arkansas) Corps releasing water through 

spillway at Norfork Dam. The U.S. Army Corps of Engineers began releasing water 
March 27 from the spillway of Norfork Dam, southeast of Mountain Home, Arkansas, 
while a powerhouse turbine was out of service for maintenance. About 6,000 cubic feet 
per second will be released, half through spillway releases and the other half through 
turbine releases. One turbine was currently out of operation for maintenance and was 
expected to be back in service by mid-April 2012. The release was not related to 
ongoing construction to implement White River Minimum Flows. 

Source: http://ozarksfirst.com/fulltext7nxd id=622482 
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